Fortinet rushes hotfix for exploited FortiClient EMS access control flaw

Fortinet released emergency hotfixes on April 4, 2026, for a critical flaw in FortiClient Endpoint Management Server (EMS) that attackers were already exploiting. The bug, CVE-2026-35616, is an improper access control weakness that can let an unauthenticated attacker execute code or commands through crafted requests.

FortiClient EMS is the central console that pushes security policies, zero trust tags and vulnerability scans to an organization's laptops and phones. Control of that console can give an attacker a lever over every managed endpoint. It was the second exploited EMS flaw in as many weeks.

What happened

Fortinet's advisory FG-IR-26-099, which describes the problem as an API authentication and authorization bypass, rates it 9.8. It affects only FortiClient EMS 7.4.5 and 7.4.6; the 7.2 branch is not affected.

According to BleepingComputer, the security firm Defused said it saw the flaw exploited as a zero-day before reporting it to Fortinet. The same firm had found CVE-2026-21643, a separate critical EMS SQL injection flaw that was reported exploited the previous week. The Shadowserver Foundation counted more than 2,000 EMS instances exposed online.

CISA added CVE-2026-35616 to its Known Exploited Vulnerabilities catalogue on April 6, and added CVE-2026-21643 on April 13. The Canadian Centre for Cyber Security issued alert AL26-007 on April 7, along with advisory AV26-313.

Fortinet credited Defused and a researcher named Nguyen Duc Anh for reporting the flaw. The company urged customers to install the hotfix immediately rather than wait for the next full release.

Why it matters

Management servers for endpoint tools are attractive because they are trusted by every device they manage. An attacker who controls the server may be able to change policies or push actions to endpoints without touching each one.

What to do

• Install the hotfix for FortiClient EMS 7.4.5 or 7.4.6 now, following Fortinet's hotfix instructions in its document library.
• Upgrade to FortiClient EMS 7.4.7 or later when available, which includes the fix.
• Make sure CVE-2026-21643 is also addressed.
• Limit internet exposure of the EMS server and review it for unexpected administrative activity.

The Cyber Centre asks organizations that find activity matching its alert to report it through My Cyber Portal or by email to [email protected].